Skip to content

Commit cb43ce6

Browse files
ahmedbougachadtapuska
ahmedbougacha
authored and
dtapuska
committed
[clang][Driver] Enable -fptrauth- ABI flags for arm64e-apple-darwin.
1 parent 00f5bfe commit cb43ce6

File tree

4 files changed

+197
-10
lines changed

4 files changed

+197
-10
lines changed

‎clang/lib/Driver/ToolChains/Darwin.cpp‎

Lines changed: 114 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1201,13 +1201,48 @@ void DarwinClang::addClangWarningOptions(ArgStringList &CC1Args) const {
12011201
}
12021202
}
12031203

1204+
static bool useObjCIsaPtrauth(const Darwin &D) {
1205+
VersionTuple TargetVersion = D.getTripleTargetVersion();
1206+
if (D.isTargetMacCatalyst() || D.TargetEnvironment == Darwin::Simulator)
1207+
return true;
1208+
switch (D.TargetPlatform) {
1209+
case Darwin::IPhoneOS:
1210+
case Darwin::TvOS:
1211+
return TargetVersion >= VersionTuple(14, 5, 0);
1212+
case Darwin::WatchOS:
1213+
case Darwin::MacOS:
1214+
case Darwin::DriverKit:
1215+
return true;
1216+
case Darwin::XROS:
1217+
return true;
1218+
}
1219+
}
1220+
1221+
static bool useCXXVTablePtrTypeAddressDiscrimination(const Darwin& D) {
1222+
VersionTuple TargetVersion = D.getTripleTargetVersion();
1223+
if (D.isTargetMacCatalyst())
1224+
return true;
1225+
switch (D.TargetPlatform) {
1226+
case Darwin::IPhoneOS:
1227+
case Darwin::TvOS:
1228+
return TargetVersion >= VersionTuple(15, 0, 0);
1229+
case Darwin::WatchOS:
1230+
case Darwin::MacOS:
1231+
case Darwin::DriverKit:
1232+
return true;
1233+
case Darwin::XROS:
1234+
return true;
1235+
}
1236+
}
1237+
12041238
void DarwinClang::addClangTargetOptions(
12051239
const llvm::opt::ArgList &DriverArgs, llvm::opt::ArgStringList &CC1Args,
12061240
Action::OffloadKind DeviceOffloadKind) const{
12071241

12081242
Darwin::addClangTargetOptions(DriverArgs, CC1Args, DeviceOffloadKind);
12091243

1210-
// On arm64e, enable pointer authentication intrinsics.
1244+
// On arm64e, enable pointer authentication (for the return address and
1245+
// indirect calls), as well as usage of the intrinsics.
12111246
if (getTriple().isArm64e()) {
12121247
// The ptrauth ABI version is 0 by default, but can be overridden.
12131248
static const constexpr unsigned DefaultPtrauthABIVersion = 0;
@@ -1241,9 +1276,87 @@ void DarwinClang::addClangTargetOptions(
12411276
CC1Args.push_back("-fptrauth-kernel-abi-version");
12421277
}
12431278

1279+
if (!DriverArgs.hasArg(options::OPT_fptrauth_returns,
1280+
options::OPT_fno_ptrauth_returns))
1281+
CC1Args.push_back("-fptrauth-returns");
1282+
12441283
if (!DriverArgs.hasArg(options::OPT_fptrauth_intrinsics,
12451284
options::OPT_fno_ptrauth_intrinsics))
12461285
CC1Args.push_back("-fptrauth-intrinsics");
1286+
1287+
if (!DriverArgs.hasArg(options::OPT_fptrauth_calls,
1288+
options::OPT_fno_ptrauth_calls))
1289+
CC1Args.push_back("-fptrauth-calls");
1290+
1291+
if (!DriverArgs.hasArg(options::OPT_fptrauth_indirect_gotos,
1292+
options::OPT_fno_ptrauth_indirect_gotos))
1293+
CC1Args.push_back("-fptrauth-indirect-gotos");
1294+
1295+
if (!DriverArgs.hasArg(options::OPT_fptrauth_auth_traps,
1296+
options::OPT_fno_ptrauth_auth_traps))
1297+
CC1Args.push_back("-fptrauth-auth-traps");
1298+
1299+
if (!DriverArgs.hasArg(options::OPT_fassume_unique_vtables,
1300+
options::OPT_fno_assume_unique_vtables))
1301+
CC1Args.push_back("-fno-assume-unique-vtables");
1302+
1303+
if (useCXXVTablePtrTypeAddressDiscrimination(*this)) {
1304+
if (!DriverArgs.hasArg(
1305+
options::OPT_fptrauth_vtable_pointer_address_discrimination,
1306+
options::OPT_fno_ptrauth_vtable_pointer_address_discrimination))
1307+
CC1Args.push_back("-fptrauth-vtable-pointer-address-discrimination");
1308+
1309+
if (!DriverArgs.hasArg(
1310+
options::OPT_fptrauth_vtable_pointer_type_discrimination,
1311+
options::OPT_fno_ptrauth_vtable_pointer_type_discrimination))
1312+
CC1Args.push_back("-fptrauth-vtable-pointer-type-discrimination");
1313+
}
1314+
1315+
if (!DriverArgs.hasArg(options::OPT_fptrauth_objc_isa,
1316+
options::OPT_fno_ptrauth_objc_isa)) {
1317+
if (useObjCIsaPtrauth(*this))
1318+
CC1Args.push_back("-fptrauth-objc-isa-mode=sign-and-auth");
1319+
else
1320+
CC1Args.push_back("-fptrauth-objc-isa-mode=sign-and-strip");
1321+
}
1322+
1323+
if (DriverArgs.hasArg(options::OPT_fapple_kext) ||
1324+
DriverArgs.hasArg(options::OPT_mkernel) || isTargetDriverKit()) {
1325+
if (!DriverArgs.hasArg(
1326+
options::OPT_fptrauth_block_descriptor_pointers,
1327+
options::OPT_fno_ptrauth_block_descriptor_pointers))
1328+
CC1Args.push_back("-fptrauth-block-descriptor-pointers");
1329+
1330+
if (!DriverArgs.hasArg(
1331+
options::OPT_fptrauth_vtable_pointer_address_discrimination,
1332+
options::OPT_fno_ptrauth_vtable_pointer_address_discrimination))
1333+
CC1Args.push_back("-fptrauth-vtable-pointer-address-discrimination");
1334+
1335+
if (!DriverArgs.hasArg(
1336+
options::OPT_fptrauth_vtable_pointer_type_discrimination,
1337+
options::OPT_fno_ptrauth_vtable_pointer_type_discrimination))
1338+
CC1Args.push_back("-fptrauth-vtable-pointer-type-discrimination");
1339+
1340+
if (!DriverArgs.hasArg(
1341+
options::OPT_fptrauth_function_pointer_type_discrimination,
1342+
options::OPT_fno_ptrauth_function_pointer_type_discrimination))
1343+
CC1Args.push_back("-fptrauth-function-pointer-type-discrimination");
1344+
}
1345+
1346+
if (DriverArgs.hasArg(options::OPT_fapple_kext) ||
1347+
DriverArgs.hasArg(options::OPT_mkernel)) {
1348+
// -fbranch-target-identification is a driver flag and isn't honored
1349+
// by -cc1. For arm64e, -mbranch-target-enforce is the -cc1 spelling,
1350+
// derived from non-arm64e -mbranch-protection=.
1351+
// Catch all 3 here anyway.
1352+
if (!DriverArgs.hasArg(options::OPT_fbranch_target_identification,
1353+
options::OPT_fno_branch_target_identification) &&
1354+
!DriverArgs.hasArg(options::OPT_mbranch_target_enforce) &&
1355+
!DriverArgs.hasArg(options::OPT_mbranch_protection_EQ)) {
1356+
CC1Args.push_back("-mbranch-target-enforce");
1357+
}
1358+
}
1359+
12471360
}
12481361
}
12491362

‎clang/test/Driver/arch-arm64e.c‎

Lines changed: 43 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,56 @@
11
// Check that we can manually enable specific ptrauth features.
22

3-
// RUN: %clang -target arm64-apple-ios -c %s -### 2>&1 | FileCheck %s --check-prefix NONE
3+
// RUN: %clang -target arm64-apple-ios15 -c %s -### 2>&1 | FileCheck %s --check-prefix NONE
44
// NONE: "-cc1"
55
// NONE-NOT: "-fptrauth-intrinsics"
6+
// NONE-NOT: "-fptrauth-calls"
7+
// NONE-NOT: "-fptrauth-returns"
8+
// NONE-NOT: "-fptrauth-indirect-gotos"
9+
// NONE-NOT: "-fptrauth-auth-traps"
10+
// NONE-NOT: "-mbranch-target-enforce"
611

7-
// RUN: %clang -target arm64-apple-ios -fptrauth-intrinsics -c %s -### 2>&1 | FileCheck %s --check-prefix INTRIN
12+
// RUN: %clang -target arm64-apple-ios15 -fptrauth-calls -c %s -### 2>&1 | FileCheck %s --check-prefix CALL
13+
// CALL: "-cc1"{{.*}} {{.*}} "-fptrauth-calls"
14+
15+
// RUN: %clang -target arm64-apple-ios15 -fptrauth-intrinsics -c %s -### 2>&1 | FileCheck %s --check-prefix INTRIN
816
// INTRIN: "-cc1"{{.*}} {{.*}} "-fptrauth-intrinsics"
917

18+
// RUN: %clang -target arm64-apple-ios15 -fptrauth-returns -c %s -### 2>&1 | FileCheck %s --check-prefix RETURN
19+
// RETURN: "-cc1"{{.*}} {{.*}} "-fptrauth-returns"
20+
21+
// RUN: %clang -target arm64-apple-ios15 -fptrauth-indirect-gotos -c %s -### 2>&1 | FileCheck %s --check-prefix INDGOTO
22+
// INDGOTO: "-cc1"{{.*}} {{.*}} "-fptrauth-indirect-gotos"
23+
24+
// RUN: %clang -target arm64-apple-ios15 -fptrauth-auth-traps -c %s -### 2>&1 | FileCheck %s --check-prefix TRAPS
25+
// TRAPS: "-cc1"{{.*}} {{.*}} "-fptrauth-auth-traps"
26+
27+
// RUN: %clang -target arm64-apple-ios15 -fbranch-target-identification -c %s -### 2>&1 | FileCheck %s --check-prefix BTI
28+
// BTI: "-cc1"{{.*}} {{.*}} "-mbranch-target-enforce"
29+
1030

1131
// Check the arm64e defaults.
32+
// isa signing depends on the target OS and is tested elsewhere.
33+
34+
// RUN: %clang -target arm64e-apple-ios15 -c %s -### 2>&1 | FileCheck %s --check-prefix DEFAULT
35+
// RUN: %clang -mkernel -target arm64e-apple-ios15 -c %s -### 2>&1 | FileCheck %s --check-prefix DEFAULT-KERN
36+
// RUN: %clang -fapple-kext -target arm64e-apple-ios15 -c %s -### 2>&1 | FileCheck %s --check-prefix DEFAULT-KERN
37+
// DEFAULT: "-fptrauth-returns" "-fptrauth-intrinsics" "-fptrauth-calls" "-fptrauth-indirect-gotos" "-fptrauth-auth-traps" "-fno-assume-unique-vtables" "-fptrauth-vtable-pointer-address-discrimination" "-fptrauth-vtable-pointer-type-discrimination" "-fptrauth-objc-isa-mode=sign-and-auth" "-target-cpu" "apple-a12"{{.*}}
38+
// DEFAULT-KERN: "-fptrauth-returns" "-fptrauth-intrinsics" "-fptrauth-calls" "-fptrauth-indirect-gotos" "-fptrauth-auth-traps" "-fno-assume-unique-vtables" "-fptrauth-vtable-pointer-address-discrimination" "-fptrauth-vtable-pointer-type-discrimination" "-fptrauth-objc-isa-mode=sign-and-auth" "-fptrauth-block-descriptor-pointers" "-fptrauth-vtable-pointer-address-discrimination" "-fptrauth-vtable-pointer-type-discrimination" "-fptrauth-function-pointer-type-discrimination" "-mbranch-target-enforce" "-target-cpu" "apple-a12"{{.*}}
1239

13-
// RUN: %clang -target arm64e-apple-ios -c %s -### 2>&1 | FileCheck %s --check-prefix DEFAULT
14-
// RUN: %clang -mkernel -target arm64e-apple-ios -c %s -### 2>&1 | FileCheck %s --check-prefix DEFAULT-KERN
15-
// RUN: %clang -fapple-kext -target arm64e-apple-ios -c %s -### 2>&1 | FileCheck %s --check-prefix DEFAULT-KERN
16-
// DEFAULT: "-fptrauth-intrinsics" "-target-cpu" "apple-a12"{{.*}}
17-
// DEFAULT-KERN: "-fptrauth-intrinsics" "-target-cpu" "apple-a12"{{.*}}
40+
// RUN: %clang -target arm64e-apple-ios15 -fno-ptrauth-calls -c %s -### 2>&1 | FileCheck %s --check-prefix DEFAULT-NOCALL
41+
// RUN: %clang -mkernel -target arm64e-apple-ios15 -fno-ptrauth-calls -c %s -### 2>&1 | FileCheck %s --check-prefix DEFAULT-KERN-NOCALL
42+
// RUN: %clang -fapple-kext -target arm64e-apple-ios15 -fno-ptrauth-calls -c %s -### 2>&1 | FileCheck %s --check-prefix DEFAULT-KERN-NOCALL
43+
// DEFAULT-NOCALL-NOT: "-fptrauth-calls"
44+
// DEFAULT-KERN-NOCALL-NOT: "-fptrauth-calls"
45+
// DEFAULT-NOCALL: "-fptrauth-returns" "-fptrauth-intrinsics" "-fptrauth-indirect-gotos" "-fptrauth-auth-traps" "-fno-assume-unique-vtables" "-fptrauth-vtable-pointer-address-discrimination" "-fptrauth-vtable-pointer-type-discrimination" "-fptrauth-objc-isa-mode=sign-and-auth" "-target-cpu" "apple-a12"{{.*}}
46+
// DEFAULT-KERN-NOCALL: "-fptrauth-returns" "-fptrauth-intrinsics" "-fptrauth-indirect-gotos" "-fptrauth-auth-traps" "-fno-assume-unique-vtables" "-fptrauth-vtable-pointer-address-discrimination" "-fptrauth-vtable-pointer-type-discrimination" "-fptrauth-objc-isa-mode=sign-and-auth" "-fptrauth-block-descriptor-pointers" "-fptrauth-vtable-pointer-address-discrimination" "-fptrauth-vtable-pointer-type-discrimination" "-fptrauth-function-pointer-type-discrimination" "-mbranch-target-enforce" "-target-cpu" "apple-a12"{{.*}}
1847

19-
// RUN: %clang -target arm64e-apple-ios -fno-ptrauth-intrinsics -c %s -### 2>&1 | FileCheck %s --check-prefix NOINTRIN
2048

49+
// RUN: %clang -target arm64e-apple-ios15 -fno-ptrauth-returns -c %s -### 2>&1 | FileCheck %s --check-prefix NORET
50+
// NORET-NOT: "-fptrauth-returns"
51+
52+
// RUN: %clang -target arm64e-apple-ios15 -fno-ptrauth-intrinsics -c %s -### 2>&1 | FileCheck %s --check-prefix NOINTRIN
2153
// NOINTRIN-NOT: "-fptrauth-intrinsics"
22-
// NOINTRIN: "-target-cpu" "apple-a12"{{.*}}
54+
55+
// RUN: %clang -target arm64e-apple-ios15 -fno-ptrauth-auth-traps -c %s -### 2>&1 | FileCheck %s --check-prefix NOTRAP
56+
// NOTRAP-NOT: "-fptrauth-auth-traps"

‎clang/test/Driver/ptrauth-block-descriptor.m‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
// RUN: %clang -target arm64e-apple-ios %s -mkernel -### 2>&1 | FileCheck %s --check-prefix=YES
2+
// RUN: %clang -target arm64e-apple-ios %s -fapple-kext -### 2>&1 | FileCheck %s --check-prefix=YES
3+
// RUN: %clang -target arm64e-apple-ios %s -fapple-kext -fptrauth-block-descriptor-pointers -### 2>&1 | FileCheck %s --check-prefix=YES
4+
// RUN: %clang -target arm64e-apple-ios %s -### 2>&1 | FileCheck %s --check-prefix=NO
5+
// RUN: %clang -target arm64e-apple-ios %s -mkernel -fno-ptrauth-block-descriptor-pointers -### 2>&1 | FileCheck %s --check-prefix=NO
6+
7+
// YES: "-cc1"{{.*}} "-fptrauth-block-descriptor-pointers"
8+
// NO-NOT: "-cc1"{{.*}} "-fptrauth-block-descriptor-pointers"

‎clang/test/Driver/ptrauth-objc-isa-mode-default.c‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
// Test objc isa signing default based on target.
2+
3+
// AUTH: "-fptrauth-objc-isa-mode=sign-and-auth"
4+
// STRIP: "-fptrauth-objc-isa-mode=sign-and-strip"
5+
6+
// Enabled on iOS14.5+, tvOS14.5+.
7+
// RUN: %clang -target arm64e-apple-ios14.5 -c %s -### 2>&1 | FileCheck %s --check-prefix AUTH
8+
// RUN: %clang -target arm64e-apple-tvos14.5 -c %s -### 2>&1 | FileCheck %s --check-prefix AUTH
9+
10+
// Hence, enabled on iOS15+, tvOS15+.
11+
// RUN: %clang -target arm64e-apple-ios15 -c %s -### 2>&1 | FileCheck %s --check-prefix AUTH
12+
// RUN: %clang -target arm64e-apple-tvos15 -c %s -### 2>&1 | FileCheck %s --check-prefix AUTH
13+
14+
// Disabled on older OS versions
15+
// RUN: %clang -target arm64e-apple-ios14.4.0 -c %s -### 2>&1 | FileCheck %s --check-prefix STRIP
16+
// RUN: %clang -target arm64e-apple-tvos14.4.0 -c %s -### 2>&1 | FileCheck %s --check-prefix STRIP
17+
18+
// Enabled on any macOS, watchOS, MacABI.
19+
// RUN: %clang -target arm64e-apple-macos12 -c %s -### 2>&1 | FileCheck %s --check-prefix AUTH
20+
// RUN: %clang -target arm64e-apple-macos11 -c %s -### 2>&1 | FileCheck %s --check-prefix AUTH
21+
// RUN: %clang -target arm64e-apple-ios15-macabi -c %s -### 2>&1 | FileCheck %s --check-prefix AUTH
22+
// RUN: %clang -target arm64e-apple-ios14-macabi -c %s -### 2>&1 | FileCheck %s --check-prefix AUTH
23+
// RUN: %clang -target arm64e-apple-watchos5 -c %s -### 2>&1 | FileCheck %s --check-prefix AUTH
24+
25+
// Enabled on any simulator targets as well.
26+
// RUN: %clang -target arm64e-apple-ios14-simulator -c %s -### 2>&1 | FileCheck %s --check-prefix AUTH
27+
// RUN: %clang -target arm64e-apple-tvos14-simulator -c %s -### 2>&1 | FileCheck %s --check-prefix AUTH
28+
// RUN: %clang -target arm64e-apple-watchos7-simulator -c %s -### 2>&1 | FileCheck %s --check-prefix AUTH
29+
30+
// Kernel doesn't care (but is exposed to block isa)
31+
// RUN: %clang -mkernel -target arm64e-apple-ios15 -c %s -### 2>&1 | FileCheck %s --check-prefix AUTH
32+
// RUN: %clang -fapple-kext -target arm64e-apple-ios15 -c %s -### 2>&1 | FileCheck %s --check-prefix AUTH

0 commit comments

Comments
 (0)